Executive brief
ag-grid is a popular JavaScript data grid component used to display and manage tabular data in web applications. Versions prior to 14.0.0 fail to sanitize user-supplied content displayed in grid cells, allowing attackers to inject malicious JavaScript code that executes in the browser of anyone viewing the grid. This could lead to session hijacking, credential theft, or defacement of the application.
Technical details
The vulnerability is a Stored or Reflected Cross-Site Scripting (CWE-79) flaw in ag-grid's rendering engine. When data containing HTML or JavaScript is passed to the grid for display, the component does not properly escape or sanitize the content before inserting it into the DOM, allowing arbitrary script execution. The attack requires that an attacker can control data displayed in the grid (e.g., via user input, database records, or API responses). Versions prior to 14.0.0 are affected; the vulnerability was fixed in version 14.0.0 by implementing proper HTML sanitization in the grid's cell rendering logic.
Affected products
- ag-grid ag-grid < 14.0.0
Timeline
- 2020-09-02: disclosed: GHSA advisory published
- 14.0.0: patched: Fix released in version 14.0.0